refactor(core): build the log filter every process installs in one place

`openlogi_core::env` exported the ingredients — the variable's name and the fallback level — and five binaries each recombined them into the same `EnvFilter::try_from_env(LOG).unwrap_or_else(|_| EnvFilter::new(LOG_DEFAULT))`; four of them wrapped it in the same stderr subscriber. That is the shape the single-source rule warns about: the owner exported ingredients, so every consumer re-made the decision.

`openlogi_core::logging` (feature `logging`, optional `tracing-subscriber`) exports the decision: `env_filter()` and, for a process with no log file of its own, `init_stderr()`. The CLI, the GUI, the overlay and the mock agent call the latter; the agent keeps its file layer and takes the filter. Three crates lose a direct `tracing-subscriber` dependency. The env guard now also flags `EnvFilter::try_from_env` outside core (five findings on the parent commit, none here).